When the ICO looks into a marketing complaint, the first thing it asks for is evidence of permission for the people who were contacted. “They signed up on our website” is not evidence. A timestamp, a source and the exact wording they saw is. This guide covers how to choose the right permission route for each UK contact, how to word it, and what to keep on file. It is general information, not legal advice.
Pick the right route for each contact
| Who you are emailing | What you need under PECR |
|---|---|
| A consumer who signed up to your newsletter | Specific consent |
| A customer who bought from you and did not opt out | Soft opt-in, for your own similar products |
| A charity supporter who gave you their details directly | Charitable purposes soft opt-in (since 5 February 2026) |
| A buyer at a limited company or public body | No prior consent, but identify yourself and offer an opt-out |
| Anyone on a purchased or rented list | Almost never usable for email or SMS |
Our page on whether email campaigns are legal in the UK explains each route in more detail.
Wording that works
Consent must be specific, so name the channel and the sender. Compare these two checkboxes on a checkout page:
- Weak: “Keep me updated about offers from us and selected partners.” The partners are unnamed, so the consent is not specific enough to cover them.
- Strong: “Email me Harbour & Co’s monthly newsletter and seasonal offers. Unsubscribe at any time.” With a separate unticked box for SMS if you plan to text.
Keep the boxes unticked, and don’t make consent a condition of buying unless the marketing really is essential to the service. Mailpro’s sign-up forms let you add separate consent fields for email and SMS.
Double opt-in: optional, but powerful evidence
UK law does not require double opt-in. It is still the simplest way to prove that the person who ticked the box owns the address, and it keeps mistyped and malicious sign-ups off your list. Mailpro’s double opt-in subscription sends the confirmation automatically and records the click. Read the difference between opt-in and double opt-in if you are deciding which to use.
What to keep on file
- Who consented: the email address or mobile number.
- When: the date and time of sign-up and of any confirmation click.
- Where: the form, page, event or till where it happened.
- What they saw: the exact wording and version of your privacy notice.
- Withdrawals: when they opted out and through which channel.
Store these alongside the contact, for example in custom contact fields, so they survive list exports and platform changes.
Trade shows and business cards
A card collected at a trade show in Birmingham or London usually belongs to a corporate subscriber, so PECR does not require prior consent to email it. The person behind it still has UK GDPR rights, and a sole trader counts as an individual subscriber. The fair approach is a single follow-up that explains how you got the address and offers a clear opt-out before you add them to regular campaigns.
Keeping permission fresh
The ICO does not set a fixed expiry date for consent, but permission given years ago by someone who has never opened an email is hard to rely on. Run a re-permission campaign before you retire dormant contacts, and never email people who have already unsubscribed to ask them to sign up again: that message is itself marketing. If your supporters or customers include EU residents, add the EU GDPR to your checklist. Once permission is sorted, move on to sending campaigns people want to read.